diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-07-29 17:34:08 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-07-29 17:34:16 +0200 |
| commit | 44fe025c2839b9da51c3b0a0ea90382ac9c14fd4 (patch) | |
| tree | cf54c18f206d92f7e39752e71b5c30335259d605 | |
| parent | bbed5564eb8155efb14146e11ef0ad67edb20e28 (diff) | |
| parent | dc7aa22b18b710aaa837c9466e9a77241f909c8a (diff) | |
| download | php-git-44fe025c2839b9da51c3b0a0ea90382ac9c14fd4.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/tests/streams/bug78326.phpt | 18 | ||||
| -rw-r--r-- | ext/standard/tests/streams/bug78326_1.phpt | 10 | ||||
| -rw-r--r-- | main/streams/streams.c | 7 |
4 files changed, 36 insertions, 1 deletions
@@ -24,6 +24,8 @@ PHP NEWS - Standard: . Fixed bug #69100 (Bus error from stream_copy_to_stream (file -> SSL stream) with invalid length). (Nikita) + . Fixed bug #78326 (improper memory deallocation on stream_get_contents() + with fixed length buffer). (Albert Casademont) 01 Aug 2019, PHP 7.3.8 diff --git a/ext/standard/tests/streams/bug78326.phpt b/ext/standard/tests/streams/bug78326.phpt new file mode 100644 index 0000000000..ca27b05f62 --- /dev/null +++ b/ext/standard/tests/streams/bug78326.phpt @@ -0,0 +1,18 @@ +--TEST-- +memory allocation on stream_get_contents() +--INI-- +memory_limit=32M +--FILE-- +<?php +$f = tmpfile(); +fwrite($f, '.'); + +$chunks = array(); +for ($i = 0; $i < 1000; ++$i) { + rewind($f); + $chunks[] = stream_get_contents($f, 1000000); +} +var_dump(count($chunks)); +?> +--EXPECT-- +int(1000) diff --git a/ext/standard/tests/streams/bug78326_1.phpt b/ext/standard/tests/streams/bug78326_1.phpt new file mode 100644 index 0000000000..8e3489db53 --- /dev/null +++ b/ext/standard/tests/streams/bug78326_1.phpt @@ -0,0 +1,10 @@ +--TEST-- +proper string length on stream_get_contents() +--FILE-- +<?php +$f = fopen('php://memory', 'rw'); +fwrite($f, str_repeat('X', 1000)); +fseek($f, 0); +var_dump(strlen(stream_get_contents($f, 1024))); +--EXPECT-- +int(1000) diff --git a/main/streams/streams.c b/main/streams/streams.c index 626c7f6a54..4b9c344dd2 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -1413,8 +1413,13 @@ PHPAPI zend_string *_php_stream_copy_to_mem(php_stream *src, size_t maxlen, int ptr += ret; } if (len) { - *ptr = '\0'; ZSTR_LEN(result) = len; + ZSTR_VAL(result)[len] = '\0'; + + /* Only truncate if the savings are large enough */ + if (len < maxlen / 2) { + result = zend_string_truncate(result, len, persistent); + } } else { zend_string_free(result); result = NULL; |